Cybersecurity self-assessment

1. Is MFA enabled on email and remote access?

2. Have you had an external penetration test in the last 12 months?

3. Would a compromised workstation be unable to reach your servers and backups?

4. Are your backups offline or immutable, and tested?

5. Are patches and vulnerabilities tracked monthly?

6. Is the network segmented (cameras, IoT, guests apart)?

7. Is guest Wi-Fi isolated from the internal network?

8. Have your web applications been tested by a third party?

9. Is your application code reviewed for security?

10. Have your employees had a phishing simulation this year?

11. Are departed employees’ accesses disabled the same day?

12. Are your access cards hard to copy?

13. Is the server room access-controlled and logged?

14. Have firewall rules been reviewed in the last year?

15. Do you have a written privacy-incident plan?